An application running on Amazon EC2 processes files that are stored in an Amazon S3 bucket. What is the BEST way to provide the application with access to the S3 bucket?

Answer options:

A.Create a new account with permissions to the S3 bucket. Provide the Application Developer with the access key ID and secret access key to be embedded into the application.
B.Create a new access key for the root user. Provide the Developer with the access key ID and secret access key embedded into the application.
C.Set the bucket properties in “Static website hosting” to “use this bucket to host a website”, and give the Developer the website URL.
D.Create an IAM role that has access to the S3 bucket. Attach the role to the EC2 instance running the application.

Correct Answer: D
The AWS Documentation mentions the following.
Applications that run on an EC2 instance must include AWS credentials in their AWS API requests. You could have your developers store AWS credentials directly within the EC2 instance and allow applications in that instance to use those credentials. But developers would then have to manage the credentials and ensure that they securely pass the credentials to each instance and update each EC2 instance when it`s time to rotate the credentials. That`s a lot of additional work.
Instead, you can and should use an IAM role to manage temporary credentials for applications that run on an EC2 instance. When you use a role, you don`t have to distribute long-term credentials (such as a user name and password or access keys) to an EC2 instance. Instead, the role supplies temporary permissions that applications can use when making calls to other AWS resources. When you launch an EC2 instance, you specify an IAM role to associate with the instance. Applications that run on the instance can then use the role-supplied temporary credentials to sign API requests.
Options A and B are incorrect since using Access keys is not a secure way to allowing access to other resources.
Option C is incorrect since this should only be used for hosting a static website.
For more information on IAM Roles, please visit the below URL-
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html